I am trying to set up GrokEVT so that I can generate .csv files of our Windows server logs here at the office. I like the control a .csv gives me compared to the Windows Event Viewer.
I also like that GrokEVT will glean all information in regards to the event logs including pulling from DLLs and the registry instead of just the .evt files.
I have installed and configured GrokEVT for my system just as the man page instructions say, but when it comes time for me to run grokevt-builddb (build a database for event log conversion) on my configuration file, I receive the following error:
root@ubuntu:/usr/local/etc/grokevt/systems# grokevt-builddb 22c /var/db/grokevt/22c
WARNING: reglookup reported: ERROR: Couldn't open registry file: /media/22C/WINDOWS/system32/config/system
ERROR: Could not automatically determine CONTROL_SET_ID
The first message in this case is most certainly because the system file is in use. Servers are always supposed to be running, and I doubt a Windows server would ever unlock this registry file that reglookup (a dependency of GrokEVT) needs to read.
This theory is further proven by the output of the cp command, saying the text file is in use:
cp: cannot open `/media/20C/WINDOWS/system32/config/system' for reading: Text file busy
I have mounted the local drives of all of our servers via Samba. Has anyone else experienced these difficulties with building a database for log file conversion, or accessing any registry files while using GrokEVT/reglookup?
I have, of course, Googled to no avail (frighteningly few search results), as well as checked permissions on the files and parent directories. It is clear that the file is locked by Windows and I need to find some way to circumvent this lock through the Samba file share so reglookup can read the file.
Any help would be greatly appreciated.